Documentation

Summary for a security reviewer

Question	Answer
Is the feature optional?	Yes. The service can be omitted entirely; no other platform function depends on it.
Does it need a model provider?	Yes, and the provider is configurable. A self-hosted model keeps all content inside the deployment boundary.
What data can it read?	Cryptographic inventory and analysis reference data, from an allowlist of collections.
Can it change anything?	No. Write operations are rejected at the tool layer, not merely unused.
What leaves the boundary with a hosted provider?	The user's question, conversation history, the database schema description, and the query results the assistant retrieved.
What never leaves?	Credentials, secrets, tokens and key material — stripped before the model sees them.
Is access authenticated?	Yes, against the platform session, when authentication is enabled in configuration.

Where the data goes

User question
   |
   v
Topic guard  ---- off-topic ----> refused; no further call, no data sent
   |
   v
Agent  -- reads --> Inventory database (allowlisted collections, read-only)
   |                        |
   |                  results, with sensitive fields stripped
   |                        |
   v                        v
Model provider  <-- question + history + schema description + retrieved results
   |
   v
Answer streamed back to the user

The model provider is the only component outside the deployment boundary, and only when a hosted provider is configured.

What the model receives

On each turn, the model is sent:

Content	Notes
The user's question	Verbatim
Conversation history for the session	So follow-up questions work
A description of the inventory schema	Field names and value enumerations, sampled from the live database. Ambiguous and legacy fields are suppressed and never shown to the model.
Algorithm resolution rules	So the model can reason about algorithm naming variants
Query results the assistant retrieved	After the redaction described below
Retrieved standards excerpts	Only when the document-search tool is enabled and matches

What the model does not receive

Credentials of any kind. Fields named password, credentials, secret, token and key_material are stripped from every result before it reaches the model.
Private key material. CBOM Secure never collects it, so it does not exist to send.
Anything outside the collection allowlist. The assistant can read only the cryptographic inventory, the analysis reference data, the standard policies, the sensor schemas and the widget catalogue. User records, credentials, host configuration and the audit trail are not on the list, and a request naming an unlisted collection is rejected before it runs.
Internal record identifiers. Stripped from results.

Controls

Control	How it is enforced
Read-only database access	The tool performs read operations only, and the write pipeline stages are explicitly rejected. Writes are unreachable rather than merely unused.
Collection allowlist	A fixed set of collections. Any other name is refused before execution.
Sensitive field redaction	Applied to every result on the way out of the database, before the model sees it.
Schema field hiding	Ambiguous and legacy fields are suppressed from the schema description.
Result bounding	Query results are bounded so a broad question cannot pull an unbounded volume of inventory into a prompt.
Topic guard	A cheap pre-screen runs before the main agent. An off-topic question is refused without the agent running and without the question reaching the main model call.
Scope instruction	The system prompt independently instructs the model to refuse off-topic questions, so the guard is not the only line.
Authentication	The service validates the caller's platform session. It can be disabled for local development; it must be enabled in any deployment.

Confirm authentication is enabled before exposing the assistant. Configuration allows it to be switched off for standalone local development. A deployment that leaves it off exposes inventory querying without a sign-in.

Choosing a provider

The provider is set in configuration and the model can be switched at runtime.

Provider	Hosting	Inventory content leaves the boundary
Anthropic	Vendor API	Yes
OpenAI	Vendor API	Yes
Google	Vendor API	Yes
Groq	Vendor API	Yes
Ollama	Self-hosted	No
LM Studio	Self-hosted	No

For a deployment where inventory content must not leave the boundary, configure a self-hosted provider and block outbound access to the hosted provider APIs at the network layer. Configuration alone states intent; the firewall rule enforces it.

With a hosted provider, the data described under "What the model receives" is transmitted to that provider and is subject to that provider's terms, retention policy and processing location. Those are the vendor's terms, not Encryption Consulting's — review them as part of your own assessment, and record the decision in whatever register your organisation keeps for third-party processors.

Retention

Where	What is retained
Model provider	Governed by the provider's own policy. CBOM Secure sets no retention on the provider side.
CBOM Secure	Conversation history for the duration of the session. It is not written to the inventory database.
Browser	Recent prompts, for the convenience of re-running them. Local to that browser.
Platform logs	Operational records of the service. Redaction applies as it does across the platform: credentials, keys and tokens are never written to a log.

API keys

The provider API key is a credential and is handled as one:

Stored encrypted at rest alongside the rest of the service configuration, and decrypted by the service at load.
Never returned in plaintext by any API.
Never written to a log.
Set either in the deployment environment at first start or in System Configuration afterwards.

Without a key the service starts and the page loads; questions fail at the provider with a clear error. That is deliberate — a missing key is a configuration problem to be surfaced, not a reason to hide the feature.

Failure behaviour

Condition	Behaviour
Service unavailable	No other platform function is affected.
Provider unreachable or key invalid	The question fails with an error naming the cause. No partial answer is fabricated.
Question off-topic	Refused by the guard before the agent runs.
Query names an unlisted collection	Rejected by the tool; the model is told the collection is not permitted.
Result set too large	Bounded, and the assistant reports that the result was truncated rather than presenting a subset as complete.

Questions worth answering before enabling

Which provider, and does inventory content leaving the boundary require approval under your third-party processing policy?
If it must not leave, is a self-hosted model provisioned, and is egress to hosted provider APIs blocked?
Is authentication enabled, and which role carries the AI access permission?
Who holds the provider API key, and how will it be rotated?
Does the provider's retention policy satisfy your own retention obligations?

CBOM Secure

AI Services Data Handling